Privacy Policy – Baumvolk

Personal data is processed insofar as this is necessary for providing and technically securing the Baumvolk platform, managing user accounts, communication, providing requested services, and preventing misuse and fraud. Where corresponding features are offered, this also includes the administration of events, courses, marketplace functions, or paid services.

Depending on the type and purpose of the processing, the following legal bases in particular may apply:

- Art. 6(1)(b) GDPR, insofar as the processing is necessary for the performance of a contract or in order to take steps prior to entering into a contract,
- Art. 6(1)(a) GDPR, insofar as the processing is based on consent,
- Art. 6(1)(f) GDPR, insofar as the processing is necessary for the purposes of legitimate interests, in particular for the secure, stable, and functional operation of the platform and for protection against misuse and unauthorized access,
- Art. 6(1)(c) GDPR, insofar as the processing is necessary for compliance with a legal obligation.

This may include, in particular, basic data such as name and username, contact data such as the email address, as well as user account and login data.

This may include, in particular, posts, comments, bonsai profiles, journal entries, photos, voluntarily submitted media contributions, author or credit information, as well as information about accessed areas and interactions within the platform.

This may include, in particular, metadata and communication data such as IP address, device information and timestamps, security and log data, as well as event, booking, and payment data where corresponding services are used.

Certain features of the Baumvolk platform require the creation of a user account. In this context, the data provided during registration, such as username and email address, as well as the data required for login and account management, are processed. Mandatory information is marked accordingly.

The processing is carried out for the purpose of creating, managing, and securing the user account and providing the associated platform features, generally on the basis of Art. 6(1)(b) GDPR.

Security-related processing, in particular for protection against unauthorized access, automated login attempts, and misuse, may additionally be based on Art. 6(1)(f) GDPR. The legitimate interest lies in the secure and reliable operation of the platform.

Users can create profiles, bonsai profiles, collections, journal entries, photos, comments, and other content within the Baumvolk platform. Depending on the respective feature and selected visibility setting, this content may be publicly visible or visible only to certain users.

The processing is carried out for the purpose of providing the selected platform features on the basis of Art. 6(1)(b) GDPR. Publicly available content may be viewed by other persons and may also be discoverable through search engines.

Users should not publish confidential data or personal data of third parties unless they have sufficient authorization to do so.

When photos or other files are uploaded, the uploaded content and the associated technical file information are processed.

Photos may contain embedded metadata, such as the date and time the photo was taken, camera model, or location information. Users should remove such metadata before uploading if they do not want it to be processed or published. Where technically provided for, metadata may be automatically removed or reduced by the platform.

Through the “Support with Media” feature, individuals can voluntarily provide Baumvolk with photographs, images, and other media for use and publication.

As part of such a submission, the following data in particular may be processed: name, email address, any author, source, or credit line provided, voluntary information and notes relating to the submission, the submitted photographs, images, or other media, any personal information contained therein, as well as technical information associated with the transmission of the files.

The processing is carried out for the purpose of receiving, reviewing, assigning, and managing media contributions, communicating with the submitting person, and using and publishing the media in accordance with the rights of use granted.

Insofar as the processing is necessary to receive the media transmission requested by the submitting person and to carry out the agreed use of the media, it is based on Art. 6(1)(b) GDPR.

Insofar as data is additionally stored for the purpose of documenting the rights of use granted and for the establishment, exercise, or defense of legal claims, the processing is based on Art. 6(1)(f) GDPR. The legitimate interest lies in particular in documenting the origin of the media contributions, the rights of use granted, and the lawfulness of their use.

A specified credit line or author attribution may be published together with the respective media contribution insofar as this was provided or agreed by the submitting person.

In accordance with the rights of use granted, the submitted media may in particular be published on Baumvolk websites and platforms, on social media channels, in newsletters, editorial publications, presentations, and as part of Baumvolk's press, public relations, and advertising activities. As a result, the media and any personal information contained in or associated with them may become visible to third parties.

Cookies and comparable storage technologies are used insofar as they are necessary for providing, securing, and ensuring the basic functionality of the website and platform. These include, in particular, WordPress cookies for login and session management, as well as temporary cookies related to two-factor authentication. Where such storage is strictly necessary in order to provide features expressly requested by users, it is used in accordance with Section 25(2) TDDDG.

First-party cookies are used to store selected settings. The “bv_lang” cookie stores the selected language for non-logged-in users for up to 30 days. The “bv_user_consent” cookie stores the selected privacy settings for up to 180 days.

According to the current technical configuration, web analytics with Matomo is carried out without analytics cookies. Matomo therefore does not set its own tracking cookies. Further details regarding web analytics are provided in the section “Web Analytics with Matomo”.

The selected privacy and consent settings can be changed at any time with effect for the future via the privacy settings.

When this website and the Baumvolk platform are accessed, technical log data is automatically processed by the web server. This may include, in particular, the IP address, date and time of access, accessed URL or file, previously visited page, browser type and browser version, operating system, amount of data transferred, and HTTP status code.

The processing serves the purposes of technical provision, stability, error analysis, and protection against misuse, attacks, and unauthorized access. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in the secure and functional operation of the platform.

Log data is stored only for as long as necessary for the stated purposes and is subsequently deleted or anonymized, unless further retention is required for the investigation of a security incident or due to legal obligations.

The self-hosted web analytics service Matomo is used to evaluate the use of this website and the Baumvolk platform and to improve the offering from both a technical and content perspective.

Under the current configuration, Matomo is operated without analytics cookies. The IP address is shortened during processing in Matomo by masking 2 bytes. In particular, the pages accessed, time of access, browser used, operating system, device type, and technical information regarding the origin of the page view are recorded.

The processing is based on Art. 6(1)(f) GDPR. The legitimate interest lies in the data-minimizing analysis and improvement of the platform. Matomo data is not disclosed to third parties for advertising purposes.

This website, the Baumvolk platform, and the associated database are hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany.

As part of the hosting services, STRATO may process personal data generated through the use of the platform. This includes, in particular, server log data as well as user and content data stored in the database and on the web server.

The processing serves the secure and reliable provision of the platform. The legal basis is Art. 6(1)(f) GDPR and, insofar as the processing is necessary for providing contractual platform features, Art. 6(1)(b) GDPR. A data processing agreement pursuant to Art. 28 GDPR is in place with STRATO.

Cloudflare Turnstile, a service provided by Cloudflare, Inc., is used to protect registration and login processes against automated access, bots, and misuse.

When Turnstile is used, technical information required to assess whether a request originates from a human or an automated system is processed. This may include, in particular, the IP address, device and browser information, and other technical security data.

The processing serves to protect the platform and its users against automated attacks and abusive login or registration attempts. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in the security and functionality of the platform.

Videos from the YouTube service may be embedded on the Baumvolk platform. YouTube is a service provided by Google. For users in the European Economic Area, services provided by Google Ireland Limited may be used; processing by other companies within the Google group, in particular Google LLC in the United States, cannot be ruled out.

The videos are embedded using YouTube's privacy-enhanced mode via the youtube-nocookie.com domain. A connection to YouTube is established only if users have expressly consented to the “External Media” category in the cookie settings. Without this consent, no YouTube player is loaded and the embedded videos do not establish a connection to YouTube.

After consent has been granted, information including the IP address, device and browser information, the page accessed, referrer information, and information regarding the use of the embedded video may be transmitted to Google or YouTube. Depending on the user's settings and login status, this information may be linked to a Google or YouTube account.

The processing is based on consent pursuant to Art. 6(1)(a) GDPR. Insofar as information is stored on or accessed from the user's terminal device, this is based on consent pursuant to Section 25(1) TDDDG.

Consent can be withdrawn at any time with effect for the future via the privacy settings of the Baumvolk platform. After consent has been withdrawn, embedded YouTube content will no longer be loaded unless consent is granted again.

Further information about data processing by Google and YouTube is available in Google's Privacy Policy.

If users contact us by email, the information transmitted is processed in order to handle the respective inquiry. This may include, in particular, the name, email address, content of the message, time of communication, and any other information voluntarily provided.

Insofar as the communication serves to initiate or perform a contract, the processing is based on Art. 6(1)(b) GDPR. In other cases, it is based on Art. 6(1)(f) GDPR. The legitimate interest lies in the proper handling and documentation of inquiries.

Email services provided by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, which form part of the hosting package used, are used for receiving and sending emails. As part of email communication, sender and recipient addresses, message content, sending and receiving times, and technical delivery and log data may in particular be processed.

A data processing agreement pursuant to Art. 28 GDPR is in place with STRATO.

Personal data is transferred to external service providers or other recipients only insofar as this is necessary for the provision, security, and administration of the Baumvolk platform.

The external service providers currently used include, in particular, STRATO GmbH for hosting, database operation, and email services, Cloudflare in connection with bot and misuse protection through Cloudflare Turnstile, as well as Google or YouTube for embedded video content where users have consented to the “External Media” category in the cookie settings.

Web analytics with Matomo is self-hosted. The analytics data collected in this context is processed on infrastructure hosted by STRATO and is not transmitted to the provider of Matomo.

Where external service providers process personal data on behalf of the controller, such processing is carried out on the basis of a data processing agreement pursuant to Art. 28 GDPR, insofar as such an agreement is legally required. Personal data is disclosed only to the extent necessary and in accordance with the applicable legal requirements.

Personal data is transferred to countries outside the European Union or the European Economic Area only where the legal requirements for such transfers are met.

In connection with the use of Cloudflare Turnstile, processing of personal data by Cloudflare, Inc. in the United States cannot be ruled out.

Cloudflare is certified under the EU-U.S. Data Privacy Framework. The European Commission's adequacy decision regarding the EU-U.S. Data Privacy Framework may therefore serve as the basis for transfers of data to the United States. Cloudflare also provides for EU Standard Contractual Clauses and supplementary safeguards for international data transfers.

When embedded YouTube videos are used after consent has been granted, processing of personal data by companies within the Google group outside the European Union or the European Economic Area, in particular in the United States, cannot be ruled out.

Where personal data is transferred to third countries, this takes place only in accordance with the legal requirements of Art. 44 et seq. GDPR. Google may rely on appropriate safeguards or applicable adequacy decisions for certain data transfers.

Personal data is stored only for as long as necessary for the respective processing purpose or for as long as statutory retention obligations apply.

Account data is generally stored for the duration of the user account. After an account is deleted, personal data is deleted or anonymized unless statutory retention obligations, security interests, or third-party rights prevent this. Published content may need to be stored for a longer period insofar as this is necessary to safeguard legitimate interests or third-party rights.

Technical log data, security data, and email logs are stored only for as long as necessary for operational security, error analysis, protection against misuse, and handling the respective communication. Longer storage may take place where this is necessary to investigate a security incident or comply with legal obligations.

Documents relevant under commercial and tax law are stored in accordance with the applicable statutory retention periods. Depending on the type of document, these periods may extend for several years.

Personal data related to voluntarily submitted media contributions is generally stored for as long as necessary for the administration and use of the respective media contribution and for documenting the rights of use granted.

If a media contribution is not used or its future use is discontinued, personal data that is no longer required will be deleted unless statutory retention obligations or legitimate interests, in particular for documenting previous uses or for the establishment, exercise, or defense of legal claims, justify further storage.

Subject to the applicable legal requirements, data subjects have, in particular, the following rights:

- Right of access pursuant to Art. 15 GDPR,
- Right to rectification pursuant to Art. 16 GDPR,
- Right to erasure pursuant to Art. 17 GDPR,
- Right to restriction of processing pursuant to Art. 18 GDPR,
- Right to data portability pursuant to Art. 20 GDPR,
- Right to object pursuant to Art. 21 GDPR,
- Right to withdraw consent previously granted with effect for the future.

In addition, data subjects have the right to lodge a complaint with a data protection supervisory authority. In particular, a complaint may be lodged with the supervisory authority at the data subject's habitual residence, place of work, or the place of the alleged data protection infringement.

Where personal data is processed on the basis of Art. 6(1)(f) GDPR, data subjects may object to such processing at any time on grounds relating to their particular situation.

In the event of an objection, the personal data concerned will no longer be processed unless compelling legitimate grounds for the processing can be demonstrated which override the interests, rights, and freedoms of the data subject, or unless the processing serves the establishment, exercise, or defense of legal claims.

Appropriate technical and organizational measures are implemented to protect personal data against loss, unauthorized access, manipulation, disclosure, and other forms of misuse.

The measures used may include, in particular, encrypted data transmission, access restrictions, role and authorization concepts, security logging, backups, regular updates, and measures to protect user accounts.

Despite appropriate protective measures, complete security of data transmission and data processing cannot be guaranteed.

This Privacy Policy may be updated if the legal situation, platform features, service providers used, or the nature of data processing changes.

The version currently published on this website shall apply. Users will be informed of material changes in an appropriate manner.